CVE-2025-38396

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create

anonymous inodes with proper security context. This replaces the current

pattern of calling alloc_anon_inode() followed by

inode_init_security_anon() for creating security context manually.

This change also fixes a security regression in secretmem where the

S_PRIVATE flag was not cleared after alloc_anon_inode(), causing

LSM/SELinux checks to be bypassed for secretmem file descriptors.

As guest_memfd currently resides in the KVM module, we need to export this

symbol for use outside the core kernel. In the future, guest_memfd might be

moved to core-mm, at which point the symbols no longer would have to be

exported. When/if that happens is still unclear.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References